1) Summary  
Affected software CMS Made Simple-2.2.15  
Vendor URL <>  
Vulnerability SQL injection  
2) Vulnerability Description  
The affected software is vulnerable to SQL injection via the m1_sortby POST parameter of the News module, reachable via the moduleinterface.php page.  
The `sortby` parameter is sanitized by replacing the `'` with the `_` character, anyway it is possible to inject arbitrary SQL language without using the `'`.  
This vulnerability is remotely exploitable and require authentication.  
3) PoC and details  
4) Credits  
This vulnerability has been discovered and reported  
by Riccardo Krauter researcher @ Soter IT Security (  
5) Timeline  
2021/02/22 Vendor was informed  
2021/02/26 Vendor said he won't fix  
2021/03/17 Public disclosure